CVE-2025-23600

WordPress Send to a Friend Addon plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

Published Mar 3, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pinal.shah Send to a Friend Addon send-booking-invites-to-friends allows Reflected XSS.This issue affects Send to a Friend Addon: from n/a through <= 1.4.1.

Analysis

Technical impact

An improper neutralization of input during web page generation in the WordPress Send to a Friend Addon allows reflected XSS. This flaw can allow an attacker to inject malicious JavaScript into a page viewed by a victim, potentially enabling cookie theft, session hijacking, or other client‑side attacks. The vulnerability aligns with CWE‑79.

Affected Systems

The flaw exists in the WordPress plugin pinal.shah Send to a Friend Addon, versions up to and including 1.4.1, which can be installed on any WordPress site that uses this plugin.

Risk and Exploitability

With a CVSS score of 7.1 the vulnerability is considered high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation as of the current data. It is not listed in the CISA KEV catalog. The likely attack vector is via a crafted URL or form submission that triggers the plugin’s unsanitized echo of user input. An attacker would need to entice or trick a user to visit such a link or fill the form; no privileged access or additional conditions are required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pinal.shah

Send to a Friend Addon

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.4.1

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Send to a Friend Addon to a version newer than 1.4.1 that contains the fix
If an update is not available, uninstall or disable the plugin entirely on the affected WordPress sites
Configure a web‑application firewall or equivalent security plug‑in to block or filter suspicious script content that exploits the Send to a Friend feature
Audit the WordPress instance for other potential XSS vectors and ensure that all input is properly sanitized or escaped

Generated by OpenCVE AI on May 1, 2026 at 14:47 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-5691	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pinal.shah Send to a Friend Addon allows Reflected XSS. This issue affects Send to a Friend Addon: from n/a through 1.4.1.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.370% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/send-booking-invites-to-friends/vulnerability/wordpress-send-to-a-friend-addon-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pinal.shah Send to a Friend Addon allows Reflected XSS. This issue affects Send to a Friend Addon: from n/a through 1.4.1.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pinal.shah Send to a Friend Addon send-booking-invites-to-friends allows Reflected XSS.This issue affects Send to a Friend Addon: from n/a through <= 1.4.1.
References	https://patchstack.com/database/wordpress/plugin/send-booking-invites-to-friends/vulnerability/wordpress-send-to-a-friend-addon-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/send-booking-invites-to-friends/vulnerability/wordpress-send-to-a-friend-addon-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Mar 4, 2025 3:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 3, 2025 1:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pinal.shah Send to a Friend Addon allows Reflected XSS. This issue affects Send to a Friend Addon: from n/a through 1.4.1.
Title		WordPress Send to a Friend Addon plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/send-booking-invites-to-friends/vulnerability/wordpress-send-to-a-friend-addon-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`